ARM平台下阻碍代码流分析的软件保护资源及对抗静态分析的反调试技术咨询

Great question—ARM’s architecture has its own unique quirks that set code obfuscation and anti-static analysis apart from x86, but there are solid resources and proven techniques to hinder reverse engineering efforts. Let’s break this down:

Useful Resources for ARM Software Protection #

• Books:
  • Practical Reverse Engineering includes dedicated chapters on ARM architecture, obfuscation, and anti-analysis techniques, with real-world examples that bridge theory and practice.
  • ARM Assembly Language Programming & Architecture dives deep into ARM’s instruction set nuances, highlighting exactly how to leverage its features for code protection.
• Open-Source Tools:
  • Obfuscator-LLVM offers robust ARM support, with pre-built obfuscation passes like control flow flattening, instruction substitution, and string encryption—all designed to disrupt static analysis tools.
  • Community-driven GitHub projects tagged with "arm-obfuscation" or "arm-anti-re" often share custom obfuscation scripts and proof-of-concept code tailored to ARM’s architecture.
• Community & Conference Content:
  • Reverse engineering-focused forums and Stack Exchange threads are filled with practitioner-shared tricks for ARM protection, from quick obfuscation hacks to full-scale anti-analysis strategies.
  • Security conferences like Black Hat, DEF CON, and REcon regularly feature talks on ARM software protection, covering both low-level instruction tricks and high-level control flow obfuscation.

Anti-Static Analysis Techniques for ARM #

Here are actionable, proven techniques to thwart tools like IDA Pro, Ghidra, or radare2 on ARM:

• Mode Switching Obfuscation:
  Frequent switching between ARM and Thumb instruction modes (using BX or BLX with the least significant bit toggled) can confuse static disassemblers. Many tools struggle to track mode changes accurately, leading to misdisassembled code and broken flow graphs.
• Control Flow Flattening:
  Restructure linear code into a flat, state-driven control flow graph. Use a central dispatcher that jumps to random basic blocks based on runtime state variables—this makes it nearly impossible for static analyzers to reconstruct the original logical flow of the program.
• False Branches & Junk Instructions:
  Insert conditional branches that never execute (e.g., CMP R0, #0; BEQ fake_block where R0 is guaranteed to be non-zero) or meaningless instruction sequences (like modifying a register and immediately restoring its value). Static tools waste resources parsing these fake paths, while runtime execution skips them entirely.
• Self-Modifying Code:
  Store encrypted or obfuscated instruction sequences in memory, then decrypt/deobfuscate them at runtime before execution. Static analyzers only see the encrypted garbage data, not the actual executable logic. Note this requires configuring memory regions to be writable and executable via MMU settings.
• Indirect Jumps & Dynamic Targets:
  Use indirect jumps like LDR PC, [PC, #-4] or BX R3 where the target address is computed at runtime (e.g., from a decrypted value or calculated offset). Static analyzers can’t easily resolve these dynamic targets, breaking their ability to trace code flow across the program.
• Register & Call Convention Abuse:
  Deliberately deviate from standard ARM calling conventions—for example, failing to preserve callee-saved registers like R4-R11, or using non-standard parameter passing via unused registers. This confuses static analyzers trying to identify function boundaries, argument lists, and return paths.

内容的提问来源于stack exchange，提问作者prgbenz